DATABASE RESOURCES PRICING ABOUT US

{"id": "CESA-2005:416-01", "vendorId": null, "type": "centos", "bulletinFamily": "unix", "title": "kdbg security update", "description": "**CentOS Errata and Security Advisory** CESA-2005:416-01\n\n\nKdbg is a K Desktop Environment (KDE) GUI for gdb, the GNU debugger.\n\nKdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file.\nIf a program is located in a world-writable location, it is possible for a\nlocal user to inject malicious commands. These commands are then executed\nwith the permission of any user that runs Kdbg. The Common Vulnerabilities\nand Exposures project assigned the name CAN-2003-0644 to this issue.\n\nUsers of Kdbg should upgrade to this updated package, which contains a\nbackported patch to correct this issue.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2005-June/061269.html\n\n**Affected packages:**\nkdbg\n\n", "published": "2005-06-05T22:52:58", "modified": "2005-06-05T22:52:58", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector": "LOCAL", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 4.6}, "severity": "MEDIUM", "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {}, "href": "https://lists.centos.org/pipermail/centos-announce/2005-June/061269.html", "reporter": "CentOS Project", "references": ["https://twitter.com/centos", "https://www.facebook.com/groups/centosproject/", "https://rhn.redhat.com/errata/rh21as-errata.html", "https://www.linkedin.com/groups/22405", "http://www.ict.swin.edu.au/staff/jnewbigin", "http://steadfast.net/", "https://youtube.com/TheCentOSProject", "https://www.reddit.com/r/CentOS/"], "cvelist": ["CVE-2003-0644"], "immutableFields": [], "lastseen": "2023-01-01T03:06:09", "viewCount": 43, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2003-0644"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2003-0644"]}, {"type": "nessus", "idList": ["REDHAT-RHSA-2005-416.NASL"]}, {"type": "redhat", "idList": ["RHSA-2005:416"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2003-0644"]}], "rev": 4}, "score": {"value": 0.3, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2003-0644"]}, {"type": "nessus", "idList": ["REDHAT-RHSA-2005-416.NASL"]}, {"type": "redhat", "idList": ["RHSA-2005:416"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2003-0644"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2003-0644", "epss": "0.000420000", "percentile": "0.056350000", "modified": "2023-03-14"}], "vulnersScore": 0.3}, "_state": {"dependencies": 1672542375, "score": 1672542480, "epss": 1678841637}, "_internal": {"score_hash": "9cbf8966ad4d7d0885b1d6a2a68cf51d"}, "affectedPackage": [{"OS": "CentOS", "OSVersion": "2", "arch": "i386", "packageVersion": "1.2.1-7", "packageFilename": "kdbg-1.2.1-7.i386.rpm", "operator": "lt", "packageName": "kdbg"}]}

{"redhat": [{"lastseen": "2021-10-21T04:43:21", "description": "Kdbg is a K Desktop Environment (KDE) GUI for gdb, the GNU debugger.\n\nKdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file.\nIf a program is located in a world-writable location, it is possible for a\nlocal user to inject malicious commands. These commands are then executed\nwith the permission of any user that runs Kdbg. The Common Vulnerabilities\nand Exposures project assigned the name CAN-2003-0644 to this issue.\n\nUsers of Kdbg should upgrade to this updated package, which contains a\nbackported patch to correct this issue.", "cvss3": {}, "published": "2005-06-02T00:00:00", "type": "redhat", "title": "(RHSA-2005:416) kdbg security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2003-0644"], "modified": "2018-03-14T15:27:01", "id": "RHSA-2005:416", "href": "https://access.redhat.com/errata/RHSA-2005:416", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2022-09-25T15:03:23", "description": "", "cvss3": {}, "published": "2003-09-07T00:00:00", "type": "ubuntucve", "title": "CVE-2003-0644", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2003-0644"], "modified": "2003-09-07T00:00:00", "id": "UB:CVE-2003-0644", "href": "https://ubuntu.com/security/CVE-2003-0644", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2022-07-04T05:59:53", "description": "Kdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file, which allows local users to execute arbitrary commands.", "cvss3": {}, "published": "2003-09-07T04:00:00", "type": "debiancve", "title": "CVE-2003-0644", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2003-0644"], "modified": "2003-09-07T04:00:00", "id": "DEBIANCVE:CVE-2003-0644", "href": "https://security-tracker.debian.org/tracker/CVE-2003-0644", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-02-09T14:00:16", "description": "Kdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file, which allows local users to execute arbitrary commands.", "cvss3": {}, "published": "2003-09-07T04:00:00", "type": "cve", "title": "CVE-2003-0644", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2003-0644"], "modified": "2008-09-05T20:34:00", "cpe": ["cpe:/a:johannes_sixt:kdbg:1.1.5", "cpe:/a:johannes_sixt:kdbg:1.2.6", "cpe:/a:johannes_sixt:kdbg:1.2.0", "cpe:/a:johannes_sixt:kdbg:1.2.3", "cpe:/a:johannes_sixt:kdbg:1.2.1", "cpe:/a:johannes_sixt:kdbg:1.1.0", "cpe:/a:johannes_sixt:kdbg:1.1.6", "cpe:/a:johannes_sixt:kdbg:1.2.5", "cpe:/a:johannes_sixt:kdbg:1.1.1", "cpe:/a:johannes_sixt:kdbg:1.2.4", "cpe:/a:johannes_sixt:kdbg:1.2.7", "cpe:/a:johannes_sixt:kdbg:1.1.3", "cpe:/a:johannes_sixt:kdbg:1.1.2", "cpe:/a:johannes_sixt:kdbg:1.2.2", "cpe:/a:johannes_sixt:kdbg:1.1.7", "cpe:/a:johannes_sixt:kdbg:1.2.8", "cpe:/a:johannes_sixt:kdbg:1.1.4"], "id": "CVE-2003-0644", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0644", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:johannes_sixt:kdbg:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:johannes_sixt:kdbg:1.1.6:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2023-01-11T14:42:12", "description": "An updated kdbg package that fixes a minor security issue is now available for Red Hat Enterprise Linux 2.1.\n\nThis update has been rated as having low security impact by the Red Hat Security Response Team.\n\nKdbg is a K Desktop Environment (KDE) GUI for gdb, the GNU debugger.\n\nKdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file. If a program is located in a world-writable location, it is possible for a local user to inject malicious commands. These commands are then executed with the permission of any user that runs Kdbg. The Common Vulnerabilities and Exposures project assigned the name CVE-2003-0644 to this issue.\n\nUsers of Kdbg should upgrade to this updated package, which contains a backported patch to correct this issue.", "cvss3": {}, "published": "2005-06-06T00:00:00", "type": "nessus", "title": "RHEL 2.1 : kdbg (RHSA-2005:416)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2003-0644"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:kdbg", "cpe:/o:redhat:enterprise_linux:2.1"], "id": "REDHAT-RHSA-2005-416.NASL", "href": "https://www.tenable.com/plugins/nessus/18421", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2005:416. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18421);\n script_version(\"1.25\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2003-0644\");\n script_xref(name:\"RHSA\", value:\"2005:416\");\n\n script_name(english:\"RHEL 2.1 : kdbg (RHSA-2005:416)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated kdbg package that fixes a minor security issue is now\navailable for Red Hat Enterprise Linux 2.1.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.\n\nKdbg is a K Desktop Environment (KDE) GUI for gdb, the GNU debugger.\n\nKdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc\nfile. If a program is located in a world-writable location, it is\npossible for a local user to inject malicious commands. These commands\nare then executed with the permission of any user that runs Kdbg. The\nCommon Vulnerabilities and Exposures project assigned the name\nCVE-2003-0644 to this issue.\n\nUsers of Kdbg should upgrade to this updated package, which contains a\nbackported patch to correct this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2003-0644\"\n );\n # http://lists.kde.org/?l=kde-announce&m=106296509815092&w=2\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://marc.info/?l=kde-announce&m=106296509815092&w=2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2005:416\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected kdbg package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kdbg\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:2.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2003/09/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/06/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/06/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^2\\.1([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 2.1\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\nif (cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i386\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2005:416\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"kdbg-1.2.1-7\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kdbg\");\n }\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}]}